CVE-2026-38431

critical · 9.8

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.

9.8

CVSS

0.4%

EPSS (exploit prob.)

33rd

EPSS percentile

2026-05-05

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
frappe	erpnext	<= 15.103.1

Check a specific version with /api/v1/cve/match.

References

https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine
https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-38431